Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/62/70bf8b-d8c4-40c3-9022-63348cdbf024/1/SL5EAXAPEnohjErTQBeUsIBv7Zs.roa
File:                     SL5EAXAPEnohjErTQBeUsIBv7Zs.roa (raw, json)
Hash identifier:          UzoGQNtoekh+R8fwH9R4JXyNDaQKSFwm/6OwhFoOYwU=
Subject key identifier:   48:BE:44:01:70:0F:12:7A:21:8C:4A:D3:40:17:94:B0:80:6F:ED:9B
Certificate issuer:       /CN=8e1c11658d2041eaf2502fe5408ed493bbd4f318
Certificate serial:       0182FD982858F776F62FFA406896A1F1E7B8
Authority key identifier: 8E:1C:11:65:8D:20:41:EA:F2:50:2F:E5:40:8E:D4:93:BB:D4:F3:18
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/jhwRZY0gQeryUC_lQI7Uk7vU8xg.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/62/70bf8b-d8c4-40c3-9022-63348cdbf024/1/SL5EAXAPEnohjErTQBeUsIBv7Zs.roa
Signing time:             Fri 02 Sep 2022 09:46:23 +0000
ROA not before:           Fri 02 Sep 2022 09:46:23 +0000
ROA not after:            Sat 01 Jul 2023 00:00:00 +0000
asID:                     204790
IP address blocks:        2a10:3c40::/29 maxlen: 29
                          2a10:3d40::/29 maxlen: 29
                          2a0c:cc40::/29 maxlen: 29
                          2a10:6480::/29 maxlen: 29
                          2a10:38c0::/29 maxlen: 29
                          2a10:3e40::/29 maxlen: 29
                          2a10:6580::/29 maxlen: 29
                          2a10:39c0::/29 maxlen: 29
                          2a10:6680::/29 maxlen: 29
                          2a10:3ac0::/29 maxlen: 29
                          2a10:6780::/29 maxlen: 29
                          2a10:7280::/29 maxlen: 29
                          2a10:6880::/29 maxlen: 29
                          2a10:3bc0::/29 maxlen: 29
                          2a0e:4200::/29 maxlen: 29
                          2a10:6980::/29 maxlen: 29
                          2a10:3cc0::/29 maxlen: 29
                          2a0d:d000::/29 maxlen: 29
                          2a10:3dc0::/29 maxlen: 29
                          2a10:3940::/29 maxlen: 29
                          2a10:3a40::/29 maxlen: 29
                          2a10:6180::/29 maxlen: 29
                          2a06:7780::/29 maxlen: 29
                          2a10:3b40::/29 maxlen: 29
                          2a10:2380::/29 maxlen: 29

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:82:fd:98:28:58:f7:76:f6:2f:fa:40:68:96:a1:f1:e7:b8
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=8e1c11658d2041eaf2502fe5408ed493bbd4f318
        Validity
            Not Before: Sep  2 09:46:23 2022 GMT
            Not After : Jul  1 00:00:00 2023 GMT
        Subject: CN=48be4401700f127a218c4ad3401794b0806fed9b
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:81:a5:fe:a7:02:ce:c8:30:b3:0a:e1:d5:be:2d:
                    54:e6:a3:53:57:63:62:c6:69:9b:a1:8d:aa:ce:d9:
                    a3:9f:d4:1a:47:9d:fd:65:ed:65:8d:fa:e8:9d:19:
                    1e:19:30:cd:f6:d1:eb:64:6e:bd:80:3b:39:75:6b:
                    48:af:43:07:09:0f:5e:db:f2:c3:37:bd:1a:21:27:
                    45:42:9e:78:21:29:a7:d0:8f:74:9b:20:db:19:02:
                    32:ec:b3:b3:0e:04:0b:e3:97:c2:80:71:b3:73:cc:
                    f1:f3:f5:1d:7e:ff:7d:91:e2:13:f2:01:f4:c7:3f:
                    60:97:5d:fd:99:93:35:fa:0f:36:4e:a3:e0:84:c5:
                    9d:a7:9b:b0:80:54:19:29:e1:a1:93:ff:7d:00:6c:
                    97:d3:f3:9a:f5:11:3c:5b:0b:4b:b5:37:8b:f3:72:
                    62:ad:4b:20:e8:43:59:b3:7d:2b:31:bd:b4:4c:61:
                    9d:a1:4b:2b:76:5e:c1:f3:7d:f6:47:0e:1d:3d:58:
                    89:97:a6:51:fc:32:b8:f7:de:2b:ae:bf:ca:29:f0:
                    df:2c:79:03:a4:d0:9b:4a:b3:1f:4a:18:05:fb:5b:
                    8e:86:7f:6b:1f:4a:14:d7:fd:ff:8f:75:aa:fb:16:
                    13:3a:e0:97:94:e3:26:18:e0:f1:e7:9f:25:30:8d:
                    bf:db
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                48:BE:44:01:70:0F:12:7A:21:8C:4A:D3:40:17:94:B0:80:6F:ED:9B
            X509v3 Authority Key Identifier:
                keyid:8E:1C:11:65:8D:20:41:EA:F2:50:2F:E5:40:8E:D4:93:BB:D4:F3:18

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/jhwRZY0gQeryUC_lQI7Uk7vU8xg.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/62/70bf8b-d8c4-40c3-9022-63348cdbf024/1/SL5EAXAPEnohjErTQBeUsIBv7Zs.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/62/70bf8b-d8c4-40c3-9022-63348cdbf024/1/jhwRZY0gQeryUC_lQI7Uk7vU8xg.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2a06:7780::/29
                  2a0c:cc40::/29
                  2a0d:d000::/29
                  2a0e:4200::/29
                  2a10:2380::/29
                  2a10:38c0::/29
                  2a10:3940::/29
                  2a10:39c0::/29
                  2a10:3a40::/29
                  2a10:3ac0::/29
                  2a10:3b40::/29
                  2a10:3bc0::/29
                  2a10:3c40::/29
                  2a10:3cc0::/29
                  2a10:3d40::/29
                  2a10:3dc0::/29
                  2a10:3e40::/29
                  2a10:6180::/29
                  2a10:6480::/29
                  2a10:6580::/29
                  2a10:6680::/29
                  2a10:6780::/29
                  2a10:6880::/29
                  2a10:6980::/29
                  2a10:7280::/29

    Signature Algorithm: sha256WithRSAEncryption
         01:94:a0:c0:d1:30:2f:b1:b0:0f:47:58:6c:4e:27:87:7c:7a:
         06:97:d2:e6:58:f8:f2:24:ce:a1:ae:16:58:9b:f3:8a:3f:7d:
         61:83:7e:b7:14:f5:81:dd:94:90:83:7b:ec:8e:d4:b4:5e:1b:
         b5:04:b4:5c:c1:1d:af:bf:63:e6:e9:7b:88:ea:5b:0b:6f:7d:
         12:89:15:29:16:12:72:7a:48:6f:12:81:53:7f:7e:de:2e:8e:
         40:86:3d:5e:30:ec:e0:50:28:35:8f:21:da:ef:e1:03:30:ae:
         9c:3d:29:9e:8a:a8:29:73:c2:84:0c:18:a8:07:59:e5:8d:3d:
         15:65:64:a1:6d:69:57:dd:99:18:fd:0d:fe:1c:39:4f:3d:55:
         37:df:03:11:9f:3b:3f:6e:49:df:93:80:9b:64:18:b3:f6:34:
         c8:9b:7a:f2:74:e4:dd:93:94:1f:bb:58:ca:b4:1d:2c:d3:5b:
         50:07:46:04:ad:4e:72:15:d4:24:62:e6:e8:77:d9:57:23:06:
         90:6b:55:a2:78:28:fa:5f:2a:36:9d:16:62:bd:45:7d:00:57:
         20:16:6c:db:d4:aa:e1:ff:e5:1a:2f:d1:39:df:31:ee:5d:14:
         7a:e9:78:58:0f:64:24:97:89:de:15:7b:0d:4d:1d:ea:1f:2f:
         58:c9:ea:e1
-----BEGIN CERTIFICATE-----
MIIFqzCCBJOgAwIBAgISAYL9mChY93b2L/pAaJah8ee4MA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKDhlMWMxMTY1OGQyMDQxZWFmMjUwMmZlNTQwOGVkNDkzYmJk
NGYzMTgwHhcNMjIwOTAyMDk0NjIzWhcNMjMwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
Eyg0OGJlNDQwMTcwMGYxMjdhMjE4YzRhZDM0MDE3OTRiMDgwNmZlZDliMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgaX+pwLOyDCzCuHVvi1U5qNTV2Ni
xmmboY2qztmjn9QaR539Ze1ljfronRkeGTDN9tHrZG69gDs5dWtIr0MHCQ9e2/LD
N70aISdFQp54ISmn0I90myDbGQIy7LOzDgQL45fCgHGzc8zx8/Udfv99keIT8gH0
xz9gl139mZM1+g82TqPghMWdp5uwgFQZKeGhk/99AGyX0/Oa9RE8WwtLtTeL83Ji
rUsg6ENZs30rMb20TGGdoUsrdl7B8332Rw4dPViJl6ZR/DK4994rrr/KKfDfLHkD
pNCbSrMfShgF+1uOhn9rH0oU1/3/j3Wq+xYTOuCXlOMmGODx558lMI2/2wIDAQAB
o4ICtzCCArMwHQYDVR0OBBYEFEi+RAFwDxJ6IYxK00AXlLCAb+2bMB8GA1UdIwQY
MBaAFI4cEWWNIEHq8lAv5UCO1JO71PMYMA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvamh3UlpZMGdRZXJ5VUNfbFFJN1VrN3ZVOHhnLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC82Mi83MGJmOGItZDhjNC00MGMzLTkwMjIt
NjMzNDhjZGJmMDI0LzEvU0w1RUFYQVBFbm9oakVyVFFCZVVzSUJ2N1pzLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC82Mi83MGJmOGItZDhjNC00MGMzLTkwMjItNjMzNDhjZGJmMDI0
LzEvamh3UlpZMGdRZXJ5VUNfbFFJN1VrN3ZVOHhnLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMIHMBggrBgEFBQcBBwEB/wSBvDCBuTCBtgQCAAIwga8DBQMq
BneAAwUDKgzMQAMFAyoN0AADBQMqDkIAAwUDKhAjgAMFAyoQOMADBQMqEDlAAwUD
KhA5wAMFAyoQOkADBQMqEDrAAwUDKhA7QAMFAyoQO8ADBQMqEDxAAwUDKhA8wAMF
AyoQPUADBQMqED3AAwUDKhA+QAMFAyoQYYADBQMqEGSAAwUDKhBlgAMFAyoQZoAD
BQMqEGeAAwUDKhBogAMFAyoQaYADBQMqEHKAMA0GCSqGSIb3DQEBCwUAA4IBAQAB
lKDA0TAvsbAPR1hsTieHfHoGl9LmWPjyJM6hrhZYm/OKP31hg363FPWB3ZSQg3vs
jtS0Xhu1BLRcwR2vv2Pm6XuI6lsLb30SiRUpFhJyekhvEoFTf37eLo5Ahj1eMOzg
UCg1jyHa7+EDMK6cPSmeiqgpc8KEDBioB1nljT0VZWShbWlX3ZkY/Q3+HDlPPVU3
3wMRnzs/bknfk4CbZBiz9jTIm3rydOTdk5Qfu1jKtB0s01tQB0YErU5yFdQkYubo
d9lXIwaQa1WieCj6Xyo2nRZivUV9AFcgFmzb1Krh/+UaL9E53zHuXRR66XhYD2Qk
l4neFXsNTR3qHy9Yyerh
-----END CERTIFICATE-----